fix(sandbox): grant Landlock execute access on read-only paths

On Landlock ABI v2+ (RHEL/OpenShift kernels), file execution requires
explicit AccessFs::Execute permission — separate from read access.
Without it, the entrypoint binary (e.g. `sleep infinity`) fails to
exec inside the sandbox, leaving entrypoint_pid at 0 and causing the
proxy to deny all CONNECT requests before OPA evaluation runs.

- Add AccessFs::Execute to read-only Landlock rules so binaries in
  /usr/bin, /bin, etc. can be executed by the entrypoint and SSH sessions
- Replace child.id().unwrap_or(0) with a proper error when exec fails,
  making the failure immediately visible instead of silently degrading

Fixes: rossoctl/rossoctl#1855

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

crates/openshell-sandbox/src/process.rs

@@ -320,7 +320,14 @@ impl ProcessHandle {
         }
 
         let child = cmd.spawn().into_diagnostic()?;
-        let pid = child.id().unwrap_or(0);
+        let pid = child.id().ok_or_else(|| {
+            miette::miette!(
+                "Entrypoint process exited immediately after spawn (exec failed). \
+                 This typically means Landlock denied execute access to the entrypoint binary. \
+                 Check that the sandbox policy grants execute permission on the entrypoint path. \
+                 [program={program}]"
+            )
+        })?;
         register_managed_child(pid);
 
         debug!(pid, program, "Process spawned");
@@ -416,7 +423,13 @@ impl ProcessHandle {
         }
 
         let child = cmd.spawn().into_diagnostic()?;
-        let pid = child.id().unwrap_or(0);
+        let pid = child.id().ok_or_else(|| {
+            miette::miette!(
+                "Entrypoint process exited immediately after spawn (exec failed). \
+                 This typically means the sandbox denied execute access to the entrypoint binary. \
+                 [program={program}]"
+            )
+        })?;
         #[cfg(target_os = "linux")]
         register_managed_child(pid);
 

crates/openshell-sandbox/src/sandbox/linux/landlock.rs

@@ -176,7 +176,7 @@ pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<Option<P
 
     let result: Result<PreparedRuleset> = (|| {
         let access_all = AccessFs::from_all(abi);
-        let access_read = AccessFs::from_read(abi);
+        let access_read = AccessFs::from_read(abi) | AccessFs::Execute;
 
         let mut ruleset = Ruleset::default();
         ruleset = ruleset
@@ -189,7 +189,7 @@ pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<Option<P
 
         for path in &read_only {
             if let Some(path_fd) = try_open_path(path, compatibility)? {
-                debug!(path = %path.display(), "Landlock allow read-only");
+                debug!(path = %path.display(), "Landlock allow read-only+execute");
                 ruleset = ruleset
                     .add_rule(PathBeneath::new(path_fd, access_read))
                     .into_diagnostic()?;